Crypto on an exchange is not covered by US deposit insurance. If the exchange is hacked or fails, customers may wait years. Mt. Gox, a Tokyo exchange, shut down in 2014 and is still repaying its customers.
An exchange is a company where people buy and sell digital coins such as Bitcoin. We wrote this guide on 8 November 2026.
Is crypto safe on an exchange? Crypto on an exchange is only as safe as the company that holds it, because the exchange controls the coins. The Federal Deposit Insurance Corporation (FDIC), which insures US bank deposits, says its insurance does not protect crypto assets. The Securities Investor Protection Corporation (SIPC), which covers customers of failed brokerage firms, excludes crypto assets that are not securities under the law.
Four exchanges ended differently:
Mt. Gox customers waited ten years for repayments in Bitcoin to begin.
Bitfinex said that within eight months it repaid customers or swapped their claims for shares.
The exchange FTX said it had paid customers 105% of their allowed claims, the amounts the bankruptcy court accepted as owed.
Bybit lost $1.5 billion in 2025 and said it covered the gap within 72 hours.
A cold wallet keeps its secret keys, the long numbers that control coins, offline. Bybit's 2025 loss still came from one.
Self-custody means holding the secret key yourself. It removes the exchange from the picture and puts the whole job of safekeeping on the owner.
What does an exchange do with your crypto?
A crypto asset is a digital token, such as Bitcoin, recorded on a public ledger called a blockchain. Whoever holds its private key controls it. A private key is a long secret number that approves transfers of the coins it controls.
On an exchange that offers custody, the exchange holds the keys. Custody means a company keeps an asset on behalf of its owner. The customer sees a balance on a screen. The coins sit in wallets the exchange controls.
A wallet is software or hardware that stores keys. Coinbase's annual report for 2025 defines a hot wallet as one connected to the internet, which lets it send transactions. It defines cold storage as keys held in any way disconnected from the internet, such as offline computers or paper records. A cold wallet is a wallet that uses cold storage.
Can customers lose coins if the exchange goes bankrupt?
Coinbase's annual report, filed on 12 February 2026, says crypto Coinbase holds for customers may count as property of a bankruptcy estate. That is the pool of assets a court shares out among creditors. Customers could then rank as general unsecured creditors, who have no claim on any particular asset.
Coinbase says it believes a court would not treat the coins that way, but courts have not yet considered this type of treatment.
Does deposit insurance cover crypto on an exchange?
The FDIC insures money in US bank accounts, up to at least $250,000 per depositor, if an insured bank fails. Its press release of 29 July 2022 said deposit insurance does not apply when a non-bank such as a crypto company fails. It said insurance also does not protect crypto assets.
SIPC is a non-profit created by Congress that works to restore cash and securities to customers when a brokerage firm fails. Its website says it does not protect any crypto asset that does not qualify as a security under the law.
Which crypto exchanges have been hacked or failed?
The table lists four cases, each tied to a court filing, regulator page, or company statement.
Date | Exchange | What happened | Amount in the source | What customers recovered |
|---|---|---|---|---|
25 Feb 2014 | Mt. Gox (Tokyo) | Closed its website, then applied for court protection on 28 Feb 2014. Coins had disappeared. | About 650,000 Bitcoin lost: the company's estimate on 20 Mar 2014 (about 850,000 missing, about 200,000 found). Separately, the US Department of Justice alleged in June 2023 a theft of at least about 647,000 Bitcoin. | Trustee began repaying in Bitcoin and Bitcoin Cash on 5 Jul 2024. Deadline moved to 31 Oct 2027. |
2 Aug 2016 | Bitfinex | Security breach. | 119,754 Bitcoin stolen, per the Department of Justice citing court documents. | Bitfinex said all BFX token holders were repaid or exchanged tokens for shares within eight months. On 8 Feb 2022 the Department of Justice announced it had seized more than 94,000 Bitcoin. |
11 Nov 2022 | FTX | Chapter 11 filing. The SEC alleged customer assets were not kept separate. | Over $8 billion of customer money, per the US Attorney (28 Mar 2024). | Court confirmed the plan on 7 Oct 2024. By the fifth distribution (31 Jul 2026), total payments so far were 105% of allowed claims for the two main customer classes. |
21 Feb 2025 | Bybit | Theft from one cold wallet, a wallet whose keys are kept offline. The FBI said North Korea was responsible. | Approximately $1.5 billion in virtual assets, per the FBI (26 Feb 2025). | Bybit said withdrawals continued and it closed the gap in its Ether holdings within 72 hours. |
Amounts are as stated by each source on its date. Recovery details for Bitfinex and Bybit come from the companies. Source: Mt. Gox company and trustee notices, US Department of Justice, Bitfinex, US Securities and Exchange Commission, FTX, FBI, Bybit
What happened at Mt. Gox in 2014?
Three days after the shutdown, on 28 February 2014, Mt. Gox applied to a Tokyo court for civil rehabilitation, a Japanese court process for repaying a failed company's creditors.
Two sources give two loss figures. The company's first statement said about 750,000 Bitcoin belonging to users and about 100,000 of its own, about 850,000 together, had disappeared. On 20 March 2014 it said it had found about 200,000 in an old wallet, which left an expected loss of about 650,000 Bitcoin.
The US Department of Justice alleged in June 2023 that defendants caused the theft of at least approximately 647,000 Bitcoin from Mt. Gox between September 2011 and at least May 2014. The 647,000 is an allegation. The 650,000 is the company's own 2014 estimate.
A trustee, the court-appointed official repaying creditors, began repaying in Bitcoin and Bitcoin Cash, a separate coin that split from Bitcoin, on 5 July 2024. On 16 October 2026, the trustee moved the deadline to 31 October 2027 and said many creditors still had not been repaid.
What happened at Bitfinex in 2016?
The Department of Justice said, citing court documents, that 119,754 Bitcoin were stolen from Bitfinex in 2016. On 8 February 2022 it announced it had seized more than 94,000 Bitcoin.
Bitfinex gave customers tokens, called BFX tokens, at 1 token per US dollar lost. Each token was a claim Bitfinex promised to redeem. The company said that within eight months every holder had been repaid at 100 cents on the dollar or had swapped tokens for shares in its parent company.
What happened at FTX in 2022?
FTX and about 100 related companies filed for Chapter 11 bankruptcy protection on or about 11 November 2022, according to the Securities and Exchange Commission (SEC). Chapter 11 is the US court process in which a company reorganises under court supervision. The SEC alleged that FTX did not keep customer assets separate from its own.
On 28 March 2024, Samuel Bankman-Fried was sentenced to 25 years in prison. The US Attorney in New York put the customer money involved at over $8 billion.
An allowed claim is an amount the bankruptcy court accepts as owed. On 17 July 2026, FTX announced a fifth payment round for 31 July 2026. It put total payments so far at 105% of allowed claims for its two main customer classes, the customers of FTX.com and the US customers.
The 105% is a percentage of each customer's allowed claim, per the FTX release.
What happened at Bybit in 2025?
On or about 21 February 2025, attackers took approximately $1.5 billion in coins from Bybit. The Federal Bureau of Investigation (FBI) said on 26 February 2025 that North Korea was responsible.
Bybit said the loss came from a single Ethereum cold wallet. Ether is the coin of the Ethereum network. Bybit said attackers used phishing, a trick that gets someone to act on a fake screen, on the screen its staff used to approve payments. Keeping keys offline did not stop a theft that tricked the staff approving the payment.
Bybit said it closed the gap in its Ether holdings within 72 hours. It also said it published an updated proof of reserves, a check that an exchange holds coins matching what it owes customers, released by Hacken, an independent blockchain security firm.
What does self-custody change?
Self-custody means the owner holds the private keys in a wallet the owner controls. No exchange sits between the owner and the coins, so an exchange's hack or failure cannot reach them.
The owner must protect the key, with no company to ask if it is lost or stolen.
Crypto on an exchange is only as safe as the exchange. Mt. Gox customers waited ten years for repayments in Bitcoin to begin, while Bitfinex, FTX, and Bybit said they repaid or covered customers.
Learn more: Bitcoin, Ethereum, and Solana compared, spot Bitcoin ETFs, and what Coinbase does.
Get the next explainer
The Academy is free to read, here on the web. The Long Trend, our free weekly letter, comes by email.
Learn more with YX Insights
This explainer is part of the YX Insights Academy. Each one takes a single idea and checks it against real data.
The same approach runs through everything else we publish:
Systematic Portfolio: ready-made portfolios for Macro & Megacaps and for Commodities. We publish the holdings and every change.
Multi-model Signals: a daily long-or-flat call on every name we cover. Each call shows how strongly our four models agree.
Research: company deep dives, macro commentary and essays on how we test.
Good places to start on the website:
Academy: more explainers like this one.
Start here: get our free weekly letter by email.
Macro & Megacaps Systematic Portfolio and Commodities: the two portfolios in detail.
Track record: live results since 3 August 2026, plus the ten-year backtest.
Upgrade: get the Systematic Portfolio, Multi-model Signals and research in full.
Common questions about crypto on an exchange
Is crypto on an exchange insured by the government?
No. The FDIC said on 29 July 2022 that deposit insurance does not apply when a crypto company fails and does not protect crypto assets. SIPC says it does not protect any crypto asset that does not qualify as a security. Insurance that an exchange buys from a private insurer is a separate arrangement.
What is the difference between a hot wallet and a cold wallet?
A hot wallet is connected to the internet, while a cold wallet keeps its keys disconnected. Coinbase's annual report defines cold storage as keys held offline, such as on offline computers or paper. A hot wallet can send transactions quickly. Bybit said its 2025 loss came from a cold wallet.
Have customers ever lost money on a crypto exchange?
Yes. At Mt. Gox, the company said about 650,000 Bitcoin were lost. At FTX, the US Attorney put the customer money involved at over $8 billion. FTX announced total payments of 105% of allowed claims for its two main customer classes in July 2026. Bitfinex and Bybit each said they repaid or covered customers.
What is proof of reserves?
Proof of reserves is a published check that an exchange holds coins matching what it owes customers. Each report covers a stated date. After its February 2025 theft, Bybit said it published an updated report released by Hacken, an independent blockchain security firm.
DISCLAIMER: This article is intended for educational purposes only. Any information or analysis in this note does not constitute an offer to sell or a solicitation of an offer to buy any securities. Nothing in this note is intended to be investment advice, nor should it be relied upon to make investment decisions. Any opinions, analyses, or probabilities expressed in this note are those of the author as of the note's date of publication and are subject to change without notice.
